passwall/passwall-server repository overview

⁠PassWall Server

PassWall Server is the core backend for open source password manager PassWall platform. Using this server, you can safely store your passwords and access them from anywhere.

⁠Support

I promise all the coffee you have ordered will be spent on this project

⁠Clients

PassWall Server can be used with PassWall Desktop⁠

⁠API Documentation

API documentation available at Postman Public Directory⁠

PassWall has both server and client side encryption. So when creating user to work with Postman you should use already SHA256 encrypted password in JSON or use a Postman Pre-request Script to encrypt json in form.

Postman Pre-request Script Usage
While creating a user via Postman, you should send a post request to /auth/signup endpoint. In the request use the JSON schema below as raw body. Do not change {{password}}, it is an environment variable in Postman.

{
    "name": "Erhan Yakut",
    "email": "[email protected]",
    "master_password": "{{password}}"
}

Then in Pre-request Script, copy and paste the javascript code below. You should change the password in the code.

var newPassword = '123456' // Change this

pm.environment.set('password', newPassword);

var encryptedPassword = CryptoJS.SHA256(pm.environment.get('password')).toString();

pm.environment.set('password',encryptedPassword);

console.log(encryptedPassword);

Click on this link⁠ to visit our Youtube playlist.

⁠Database support

PassWall works with PostgreSQL databases.

⁠Configuration

When PassWall Server starts, it automatically generates config.yml in the folders below:
MacOS: $HOME/Library/Application Support/passwall-server
Windows: $APPDATA/passwall-server
Linux: $HOME/.config/passwall-server

⁠Security

1. PassWall uses The Advanced Encryption Standard (AES) encryption algorithm with Galois/Counter Mode (GCM) symmetric-key cryptographic mode. Passwords encrypted with AES can only be decrypted with the passphrase defined in the config.yml file.

2. Endpoints are protected with security middlewares against attacks like XSS.

3. Against SQL injection, PassWall uses Gorm package to handle database queries which clears all queries.

4. There is rate limiter for signin attempts against brute force attacks.

⁠Environment Variables

These environment variables are accepted:

Server Variables:

• PORT
• PW_SERVER_USERNAME
• PW_SERVER_PASSWORD
• PW_SERVER_PASSPHRASE
• PW_SERVER_SECRET
• PW_SERVER_TIMEOUT
• PW_SERVER_GENERATED_PASSWORD_LENGTH
• PW_SERVER_ACCESS_TOKEN_EXPIRE_DURATION
• PW_SERVER_REFRESH_TOKEN_EXPIRE_DURATION

Database Variables

• PW_DB_NAME
• PW_DB_USERNAME
• PW_DB_PASSWORD
• PW_DB_HOST
• PW_DB_PORT
• PW_DB_LOG_MODE

Backup Variables

• PW_BACKUP_FOLDER
• PW_BACKUP_ROTATION
• PW_BACKUP_PERIOD

⁠Development usage

Install Go to your computer. Pull the server repo. Execute the command in server folder.

go run ./cmd/passwall-server

⁠Docker

docker-compose up --build

⁠Hello Contributors

1. Don't send too much commit at once. It will be easier for us to do a code review.

2. Be sure to take a look at the dev branch. The version I am working on is there.

3. First try to fix // TODO:s in the code.

4. Then you can contribute to the development by following the mile stones.

5. Don't mess with the user interface. The design guide has not been released yet.